@sveltejs/kit 3.0.0-next.23 → 3.0.0-next.25

package/src/exports/vite/module_ids.js

@@ -1,20 +1,10 @@
 import { fileURLToPath } from 'node:url';
 import { posixify } from '../../utils/os.js';
 
-export const sveltekit_env = '\0virtual:__sveltekit/env';
-export const sveltekit_env_public_client = '\0virtual:__sveltekit/env/public/client';
-export const sveltekit_env_public_server = '\0virtual:__sveltekit/env/public/server';
-export const sveltekit_env_private = '\0virtual:__sveltekit/env/private';
-export const sveltekit_env_service_worker = '\0virtual:__sveltekit/env/service-worker';
-export const sveltekit_server = '\0virtual:__sveltekit/server';
-export const service_worker = '\0virtual:service-worker';
-
-export const sveltekit_manifest_data = '\0virtual:__sveltekit/manifest-data';
-
 export const app_server = posixify(
 	fileURLToPath(new URL('../../runtime/app/server/index.js', import.meta.url))
 );
 
 export const app_env_private = posixify(
-	fileURLToPath(new URL('../../runtime/app/env/private.js', import.meta.url))
+	fileURLToPath(new URL('../../runtime/app/env/private/index.js', import.meta.url))
 );

package/src/exports/vite/plugins/env-vars.js

@@ -0,0 +1,159 @@
+/** @import { Plugin, ResolvedConfig } from 'vite' */
+/** @import { EnvVarConfig } from '@sveltejs/kit/env' */
+/** @import { ValidatedConfig } from 'types' */
+import path from 'node:path';
+import { exactRegex } from '@rolldown/pluginutils';
+import * as sync from '../../../core/sync/sync.js';
+import { create_env_modules, resolve_env_entry } from '../../../core/env.js';
+import { import_peer } from '../../../utils/import.js';
+import { write_if_changed } from '../../../core/sync/utils.js';
+import { posixify } from '../../../utils/os.js';
+
+/**
+ * Generate (and, in dev, maintain) the `${outDir}/generated/{build,dev}/env` modules
+ * derived from `src/env.ts`
+ *
+ * @param {ValidatedConfig} config
+ * @param {(variables: Record<string, EnvVarConfig<any>> | null) => void} callback
+ * @returns {Plugin}
+ */
+export function plugin_env_vars(config, callback) {
+	/** @type {string} */
+	let dir;
+
+	/** @type {Record<string, any>} */
+	let env;
+
+	/** @type {ResolvedConfig} */
+	let resolved_config;
+
+	/** @type {string | null} */
+	let resolved_entry = null;
+
+	/** @type {Set<string>} */
+	let deps = new Set();
+
+	let is_build = false;
+
+	/** @type {Promise<void> | undefined} */
+	let generated;
+
+	async function generate() {
+		const synced = await sync.env(
+			config,
+			resolved_entry,
+			resolved_config.root,
+			resolved_config.mode
+		);
+
+		deps = synced.deps;
+
+		const vars = synced.variables;
+		callback(vars);
+
+		const modules = create_env_modules(
+			config,
+			vars,
+			env,
+			dir,
+			resolved_entry && posixify(path.relative(dir, resolved_entry)),
+			!is_build
+		);
+
+		for (const [file, code] of Object.entries(modules)) {
+			write_if_changed(`${dir}/${file}`, code);
+		}
+	}
+
+	return {
+		name: 'vite-plugin-sveltekit-env-vars',
+
+		async configResolved(c) {
+			resolved_config = c;
+
+			const vite = await import_peer('vite', c.root);
+			env = vite.loadEnv(c.mode, path.resolve(c.root, config.env.dir), '');
+
+			is_build = c.command === 'build';
+
+			dir = posixify(
+				path.resolve(c.root, config.outDir, `generated/${is_build ? 'build' : 'dev'}/env`)
+			);
+		},
+
+		async buildStart() {
+			// runs once via the memo — per-process, whichever environment starts first
+			// (environment names vary by adapter), and never in the postbuild forks,
+			// which resolve the config without building
+			await (generated ??= (async () => {
+				resolved_entry = resolve_env_entry(config, resolved_config.root);
+				await generate();
+			})());
+		},
+
+		configureServer(server) {
+			// `handleHotUpdate` only fires for `change` events on files Vite already knows about,
+			// so it doesn't cover the env entry being created or deleted while the dev server is
+			// running. Watch for those events explicitly, re-resolve the entry, regenerate the
+			// modules and trigger a full reload (mirroring the previous behaviour).
+			const on_entry_add_unlink = async (/** @type {string} */ file) => {
+				const resolved = resolve_env_entry(config, resolved_config.root);
+
+				if (file === resolved_entry || file === resolved) {
+					resolved_entry = resolved;
+					await generate();
+					server.hot.send({ type: 'full-reload' });
+				}
+			};
+
+			server.watcher.on('add', on_entry_add_unlink);
+			server.watcher.on('unlink', on_entry_add_unlink);
+		},
+
+		async handleHotUpdate(update) {
+			if (!deps.has(update.file)) return;
+			await generate();
+		}
+	};
+}
+
+/**
+ * @param {() => string | null} get_service_worker_entry_file
+ * @returns {Plugin}
+ */
+export function plugin_service_worker_env_vars(get_service_worker_entry_file) {
+	/** @type {string | null} */
+	let service_worker_entry_file;
+
+	/** @satisfies {Plugin} */
+	const plugin = {
+		name: 'vite-plugin-sveltekit-service-worker-env',
+		configResolved() {
+			service_worker_entry_file = get_service_worker_entry_file();
+
+			if (service_worker_entry_file) {
+				plugin.transform.filter = {
+					id: exactRegex(service_worker_entry_file)
+				};
+			}
+		},
+		applyToEnvironment(environment) {
+			return !!service_worker_entry_file && environment.config.consumer === 'client';
+		},
+		transform: {
+			filter: {},
+			handler(code) {
+				// prepend the service worker with an import that configures
+				// `env`, in case `$app/env/public` is imported. In production
+				// this is required: dynamic public env vars aren't known at
+				// build time, so `env.js` is loaded at runtime. In dev, the
+				// imported module just inlines the current values instead.
+				return {
+					code: `import '<sveltekit:generated>/env/service-worker.js';\n${code}`
+				};
+			}
+		}
+	};
+
+	return plugin;
+}

package/src/exports/vite/plugins/guard.js

@@ -0,0 +1,205 @@
+/** @import { TopLevelFilterExpression } from '@rolldown/pluginutils' */
+/** @import { ManifestData, ValidatedConfig } from 'types' */
+/** @import { Plugin } from 'vite' */
+import path from 'node:path';
+import { and, exactRegex, importerId, include, not } from '@rolldown/pluginutils';
+import { app_env_private, app_server } from '../module_ids.js';
+import {
+	error_for_missing_config,
+	normalize_id,
+	remote_module_pattern,
+	server_only_directory_pattern,
+	server_only_module_pattern
+} from '../utils.js';
+import { stackless } from '../../../utils/error.js';
+import { posixify } from '../../../utils/os.js';
+
+/**
+ * Ensures that client-side code can't accidentally import server-side code,
+ * whether in `*.server.js` files, `$app/server`, any `/server/` directory, or `$app/env/private`
+ * @param {ValidatedConfig} kit
+ * @param {() => { vite: typeof import('vite'); root: string; normalized_aliases: Array<{ alias: string, path: string }>; service_worker_entry_file: string | null; }} get_config
+ * @param {() => ManifestData} get_manifest_data
+ * @returns {Plugin}
+ */
+export function plugin_guard(kit, get_config, get_manifest_data) {
+	/** @type {string} */
+	let root;
+
+	/** @type {string} */
+	let normalized_cwd;
+	/** @type {Array<{ alias: string, path: string }>} */
+	let normalized_aliases;
+	/** @type {string} */
+	let normalized_node_modules;
+	/** @type {string} */
+	let normalized_routes;
+	/** @type {string} */
+	let normalized_assets;
+
+	/** @type {string | null} */
+	let service_worker_entry_file;
+
+	/** @type {Map<string, Set<string>>} */
+	const import_map = new Map();
+
+	return {
+		name: 'vite-plugin-sveltekit-guard',
+
+		// Run this plugin before built-in resolution, so that relative imports
+		// are added to the module graph
+		enforce: 'pre',
+
+		configResolved() {
+			/** @type {typeof import('vite')} */
+			let vite;
+			({ vite, root, normalized_aliases, service_worker_entry_file } = get_config());
+
+			normalized_cwd = vite.normalizePath(root);
+			normalized_node_modules = vite.normalizePath(path.resolve(root, 'node_modules'));
+			normalized_routes = vite.normalizePath(path.resolve(root, kit.files.routes));
+			normalized_assets = vite.normalizePath(path.resolve(root, kit.files.assets));
+		},
+
+		applyToEnvironment(environment) {
+			// the import map is only read for client-side violations in `load`, so skip other environments
+			return environment.config.consumer === 'client';
+		},
+
+		resolveId: {
+			// composable filters are not accepted type-wise but still work during build
+			// see https://github.com/vitejs/rolldown-vite/issues/605
+			filter: /** @type {any} */ (
+				/** @satisfies {TopLevelFilterExpression[]} */ ([
+					include(and(importerId(/.+/), not(importerId(/index\.html$/))))
+				])
+			),
+			async handler(id, importer, options) {
+				// composable filters only work during build so we still need this guard for dev
+				// see https://github.com/vitejs/rolldown-vite/issues/605
+				if (importer && !importer.endsWith('index.html')) {
+					const resolved = await this.resolve(id, importer, { ...options, skipSelf: true });
+
+					if (resolved) {
+						const normalized = normalize_id(resolved.id, normalized_aliases, normalized_cwd);
+
+						let importers = import_map.get(normalized);
+
+						if (!importers) {
+							importers = new Set();
+							import_map.set(normalized, importers);
+						}
+
+						importers.add(normalize_id(importer, normalized_aliases, normalized_cwd));
+					}
+				}
+			}
+		},
+
+		load: {
+			filter: {
+				id: [
+					exactRegex(app_server),
+					exactRegex(app_env_private),
+					server_only_module_pattern,
+					server_only_directory_pattern
+				]
+			},
+			handler(id) {
+				const normalized = normalize_id(id, normalized_aliases, normalized_cwd);
+
+				let is_server_only = normalized === '$app/env/private' || normalized === '$app/server';
+
+				// skip .server.js files outside the cwd or in node_modules, as the filename might not mean 'server-only module' in this context
+				if (id.startsWith(normalized_cwd) && !id.startsWith(normalized_node_modules)) {
+					// e.g. `server.ts` or `foo.server.ts`
+					is_server_only ||= server_only_module_pattern.test(id);
+
+					// e.g. `server/foo.ts`, unless in `src/routes` or `static`
+					is_server_only ||=
+						server_only_directory_pattern.test(id) &&
+						!id.startsWith(normalized_routes + '/') &&
+						!id.startsWith(normalized_assets + '/');
+				}
+
+				if (!is_server_only) return;
+
+				const manifest_data = get_manifest_data();
+
+				/** @type {Set<string>} */
+				const entrypoints = new Set();
+				for (const node of manifest_data.nodes) {
+					if (node.component) entrypoints.add(node.component);
+					if (node.universal) entrypoints.add(node.universal);
+				}
+
+				if (manifest_data.hooks.client) entrypoints.add(manifest_data.hooks.client);
+				if (manifest_data.hooks.universal) entrypoints.add(manifest_data.hooks.universal);
+
+				if (service_worker_entry_file) {
+					entrypoints.add(posixify(path.relative(root, service_worker_entry_file)));
+				}
+
+				// Walk up the import graph from the server-only module, looking for a chain
+				// that leads back to a client entrypoint. We search all candidates (not just
+				// the first) because a module can be imported by both server and client code,
+				// and a greedy first-match could follow a server-only branch that never
+				// reaches an entrypoint — see https://github.com/sveltejs/kit/issues/16232
+				/** @type {Set<string>} */
+				const visited = new Set([normalized]);
+
+				/**
+				 * @param {string} current
+				 * @param {string[]} chain
+				 * @returns {string[] | null}
+				 */
+				function find_chain(current, chain) {
+					const importers = import_map.get(current);
+					if (!importers) return null;
+
+					for (const importer of importers) {
+						if (visited.has(importer)) continue;
+						visited.add(importer);
+
+						const next_chain = [...chain, importer];
+						if (entrypoints.has(importer)) {
+							return next_chain;
+						}
+						const result = find_chain(importer, next_chain);
+						if (result) return result;
+					}
+					return null;
+				}
+
+				const chain = find_chain(normalized, [normalized]);
+
+				if (chain) {
+					if (chain.some((id) => remote_module_pattern.test(id))) {
+						error_for_missing_config('remote functions', 'experimental.remoteFunctions', 'true');
+					}
+
+					const pyramid = chain
+						.reverse()
+						.map((id, i) => {
+							return `${' '.repeat(i + 1)}${id}`;
+						})
+						.join(' imports\n');
+
+					let message = `Cannot import ${normalized} into code that runs in the browser, as this could leak sensitive information.`;
+					message += `\n\n${pyramid}`;
+					message += `\n\nIf you're only using the import as a type, change it to \`import type\`.`;
+
+					throw stackless(message);
+				}
+
+				// No chain from this server-only module to a client entrypoint was found —
+				// the module is only imported from server code, which is valid.
+			}
+		},
+
+		// avoid watch mode rebuilds using stale import map data
+		buildEnd() {
+			import_map.clear();
+		}
+	};
+}

package/src/exports/vite/preview/index.js

@@ -9,6 +9,7 @@ import sirv from 'sirv';
 import { loadEnv, normalizePath } from 'vite';
 import { createReadableStream, getRequest, setResponse } from '../../../exports/node/index.js';
 import { SVELTE_KIT_ASSETS } from '../../../constants.js';
+import { relative_pathname } from '../../../utils/url.js';
 import { is_chrome_devtools_request, not_found } from '../utils.js';
 import { stackless } from '../../../utils/error.js';
 
@@ -176,9 +177,9 @@ export async function preview(vite, vite_config, svelte_config) {
 					}
 
 					if (redirect) {
-						if (search) redirect += search;
-						res.writeHead(307, {
-							location: redirect
+						res.writeHead(308, {
+							// relative so (possibly invisible) path prefixes are preserved
+							location: relative_pathname(pathname, redirect) + search
 						});
 
 						res.end();
@@ -206,7 +207,8 @@ export async function preview(vite, vite_config, svelte_config) {
 
 			const request = getRequest({
 				base: `${protocol}://${host}`,
-				request: req
+				request: req,
+				response: res
 			});
 
 			setResponse(

package/src/exports/vite/utils.js

@@ -1,12 +1,16 @@
+/** @import { UserConfig } from 'vite' */
+/** @import { EnforcedConfig } from './types.js' */
 import fs from 'node:fs';
 import path from 'node:path';
+import process from 'node:process';
+import { styleText } from 'node:util';
 import { posixify } from '../../utils/os.js';
 import { negotiate } from '../../utils/http.js';
 import { escape_html } from '../../utils/escape.js';
 import { escape_for_regexp } from '../../utils/regex.js';
 import { stackless } from '../../utils/error.js';
 import { dedent } from '../../core/sync/utils.js';
-import { app_server, app_env_private, sveltekit_env_private } from './module_ids.js';
+import { app_server, app_env_private } from './module_ids.js';
 
 /**
  * Transforms alias to a valid vite.resolve.alias array.
@@ -119,7 +123,7 @@ export function normalize_id(id, aliases, cwd) {
 		return '$app/server';
 	}
 
-	if (id === app_env_private || id === sveltekit_env_private) {
+	if (id === app_env_private) {
 		return '$app/env/private';
 	}
 
@@ -191,8 +195,6 @@ function can_export_remote_module(directory) {
 export const server_only_module_pattern = /[/.]server\.[^/]+$/;
 export const server_only_directory_pattern = /\/server\//;
 
-export const strip_virtual_prefix = /** @param {string} id */ (id) => id.replace('\0virtual:', '');
-
 /**
  * For `error_for_missing_config('remote functions', 'experimental.remoteFunctions', 'true')`,
  * returns:
@@ -229,3 +231,96 @@ export function error_for_missing_config(feature_name, path, value) {
 		`
 	);
 }
+
+/** @type {EnforcedConfig} */
+export const enforced_config = {
+	appType: true,
+	base: true,
+	build: {
+		cssCodeSplit: true,
+		emptyOutDir: true,
+		lib: {
+			entry: true,
+			name: true,
+			formats: true
+		},
+		manifest: true,
+		outDir: true,
+		rolldownOptions: {
+			input: true,
+			output: {
+				format: true,
+				entryFileNames: true,
+				chunkFileNames: true,
+				assetFileNames: true
+			},
+			preserveEntrySignatures: true
+		},
+		ssr: true
+	},
+	publicDir: true,
+	resolve: {
+		alias: {
+			$app: true,
+			$env: true,
+			'<sveltekit:generated>': true
+		}
+	}
+};
+
+/**
+ * @param {UserConfig} config
+ * @param {UserConfig} resolved_config
+ */
+export function warn_overridden_config(config, resolved_config) {
+	const overridden = find_overridden_config(config, resolved_config, enforced_config, '', []);
+
+	if (overridden.length > 0) {
+		console.error(
+			styleText(
+				['bold', 'red'],
+				'The following Vite config options will be overridden by SvelteKit:'
+			) + overridden.map((key) => `\n  - ${key}`).join('')
+		);
+	}
+}
+
+/**
+ * @param {Record<string, any>} config
+ * @param {Record<string, any>} resolved_config
+ * @param {EnforcedConfig} enforced_config
+ * @param {string} path
+ * @param {string[]} out used locally to compute the return value
+ */
+export function find_overridden_config(config, resolved_config, enforced_config, path, out) {
+	if (config == null || resolved_config == null) {
+		return out;
+	}
+
+	for (const key in enforced_config) {
+		if (typeof config === 'object' && key in config && key in resolved_config) {
+			const enforced = enforced_config[key];
+			const resolved = resolved_config[key];
+
+			if (enforced === true) {
+				if (comparable(config[key]) !== comparable(resolved)) {
+					out.push(path + key);
+				}
+			} else {
+				find_overridden_config(config[key], resolved, enforced, path + key + '.', out);
+			}
+		}
+	}
+	return out;
+}
+
+/**
+ * Normalizes a config value for comparison, since Windows paths may use backslashes
+ * and differ in casing (e.g. the drive letter) depending on where they came from.
+ * @param {any} value
+ */
+export function comparable(value) {
+	if (typeof value !== 'string') return value;
+	const normalized = posixify(value);
+	return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
+}

package/src/runtime/app/env/{types.d.ts → client.js}

@@ -1,19 +1,24 @@
+import { payload } from '../../client/payload.js';
+
 /**
  * `true` if the app is running in the browser.
+ * @type {boolean}
  */
-export const browser: boolean;
+export const browser = true;
 
 /**
  * Whether the dev server is running. This is not guaranteed to correspond to `NODE_ENV` or `MODE`.
+ * @type {boolean}
  */
-export const dev: boolean;
+export const dev = __SVELTEKIT_DEV__;
 
 /**
  * SvelteKit analyses your app during the `build` step by running it. During this process, `building` is `true`. This also applies during prerendering.
+ * @type {boolean}
  */
-export const building: boolean;
+export const building = false;
 
 /**
  * The value of `config.version.name`.
  */
-export const version: string;
+export const version = payload.version;

package/src/runtime/app/env/index.js

@@ -1,2 +1 @@
-export { BROWSER as browser, DEV as dev } from 'esm-env';
-export { building, version } from './internal.js';
+export { browser, dev, building, version } from '#app/env';

package/src/runtime/app/env/private/index.js

@@ -0,0 +1 @@
+export * from '<sveltekit:generated>/env/private/server.js';

package/src/runtime/app/env/public/client.js

@@ -1 +1 @@
-export * from '__sveltekit/env/public/client';
+export * from '<sveltekit:generated>/env/public/client.js';

package/src/runtime/app/env/public/server.js

@@ -1 +1 @@
-export * from '__sveltekit/env/public/server';
+export * from '<sveltekit:generated>/env/public/server.js';

package/src/runtime/app/env/{internal.js → server.js}

@@ -1,8 +1,8 @@
-import { BROWSER } from 'esm-env';
-import { payload } from '../../client/payload.js';
-
-export const version = BROWSER ? payload.version : __SVELTEKIT_APP_VERSION__;
+export const browser = false;
+export const dev = __SVELTEKIT_DEV__;
+export const version = __SVELTEKIT_APP_VERSION__;
 export let building = false;
+
 export let prerendering = false;
 
 export function set_building() {